Introduction

Since the launch of Silk Road, the first modern dark web marketplace (DWM), in 20111 millions of buyers and sellers have traded on the dark web. DWMs have gained popularity because their users can easily and anonymously access them through browsers, such as The Onion Router (Tor)2, and trade goods using cryptocurrencies, such as Bitcoin3. They offer a variety of illicit goods including drugs, firearms, credit cards dumps, and fake IDs4. Indeed, DWMs could represent a threat to society and public health. For instance, during the COVID-19 pandemic, DWMs sold COVID-19 related goods (e.g., masks and COVID-19 tests) that were in shortage in regulated marketplaces as well as unapproved vaccines and fake treatments5,6,7. Law enforcement agencies have therefore targeted DWMs and users trading on them, performing dozens of arrests and seizing millions of US dollars worth of Bitcoin8,9,10. Despite police raids and unexpected closures, DWM trading volume has been steadily increasing and exceeded $1.5 billion for the first time in 202011.

DWM users display complex trading patterns within the marketplace environment. For example, users migrate to alternative DWMs when a DWM that they trade on closes12,13. Such migration of users is aided by communication via online forums and chats on the dark web14,15. However, little is known about how DWM users trade and transact outside the DWMs. On the one hand, some recent works have shown that a significant number of DWM users trade drugs and other illicit goods using social media platforms, such as Facebook, Telegram, and Reddit16,17,18,19,20. Moreover, several qualitative, interview-based studies have shown that DWM users form direct trading relationships with other users, starting user-to-user (U2U) pairs that bypass the intermediary role of DWMs21,22. Past research has also found that sellers on regulated online marketplaces and social medial platforms may decide to use intermediaries, such as Facebook groups or Instagram, to find new customers, and may start direct U2U trading with potential buyers23. In this paper, we look closely at patterns of U2U trading relationships among DWM users.

Figure 1
figure 1

Ego and full networks. (a) Schematic representation of an ego network surrounding a dark web marketplace (“DWM”, in red). The DWM interacts with its users (“U”, in black). User-to-user (U2U) pairs are represented by arrows (direction indicates the flow of Bitcoin) and by their respective users. (b) Multiple ego networks may be aggregated to form the full network.

Full size image

The starting point for this paper is the identification of U2U networks around DWMs. We analyse 40 DWMs for the time period spanning from June 18, 2011 to January 31, 2021. Our dataset covers all major DWMs that have ever existed, as identified by the European Monitoring Centre, Europol, the World Health Organization, and independent researchers24,25,26. Our analysis focuses on Bitcoin – the most popular cryptocurrency both on DWMs27,28 and in the regulated economy29,30. We focus on two kinds of transactions, occurring (i) between the user and a DWM and (ii) between two users of the same DWM. The result is 40 distinct marketplace ego networks containing user-DWM and U2U transactions, whose typical structure is depicted in Fig. 1a. In each network, links are directed and the arrows point at the receiver of Bitcoin. Since users often migrate from one DWM to another12 and become users of multiple DWMs, the 40 ego networks are not isolated but can be combined to form one full network, as shown in Fig. 1b.

Previous analyses of U2U trading relationships around DWMs include only two studies21,22 based on unstructured21 or semi-structured22 interviews of 17 users of Silk Road and 13 sellers on various DWMs, respectively. Here, we dramatically extend previous work by exploring the collective emergence and structure of U2U pairs. First, we observe that the U2U network, formed by all transactions between pairs of users, has a larger trading volume than DWMs themselves. We then identify stable U2U trading relationships, which represent a subset of persistent pairs in our dataset31,32 forming the backbone of the U2U network. We find that 137,667 (i.e., 1.7% out of 7.85 million total) pairs are stable, generating a total trading volume of $1.5 billion (i.e., 5% out of $30 billion total volume). We then explore the behaviour of users forming stable U2U pairs. We reveal that stable U2U pairs play a crucial role for marketplaces by spending significantly more time and generating far greater transaction volume with DWMs than other users. By analysing the temporal evolution of stable pairs, we unveil that DWMs acted as meeting points for 37,192 users (out of around 16 million), whose trading volume is estimated to be $417 million. Importantly, these newly formed stable pairs persist over time and transact for several months even after the closure of the DWM that spurred their formation. Finally, we observe that COVID-19 only had a temporary impact on the evolution of stable U2U pairs, which continued to increase their trading volume throughout 2020.

Results

Large number of U2U transactions

Ego networks

We start our analysis by measuring the extent of the U2U network around each DWM. The percentages of users forming U2U pairs vary across DWMs, with a median value of 38% (min 23%, max 68%). The variance in the percentage of users with U2U pairs is shown in Fig. 2a. The Figure shows that the number of users with U2U pairs is almost monomial in the number of users interacting with a DWM, with an estimated exponent equal to 1.06 and \(R^2 = 0.969\) , see Section S1 for details on the fitting procedure. The total trading volume users sent to the marketplace is essentially equivalent to the one they receive from it (two-sided Wilcoxon test33: \(W=330\), \(p=0.282\)). Importantly, the total trading volume users sent to a DWM (and consequently the one that they receive from it) is always lower than the volume exchanged through U2U transactions, as shown in Fig. 2b.

Figure 2
figure 2

User-DWM and U2U transactions. (a) Total number of users interacting with a DWM against the total number of users forming U2U transactions. The dotted line corresponds to the result of a fitted power law function. (b) Trading volume in dollars sent to a DWM compared with the total trading volume in its surrounding U2U transactions. The dashed line is the bisector and allows to easily compare the two trading volumes. (c) Total monthly trading volume sent to all DWMs and exchanged in all unique U2U pairs. We do not include the trading volume received from DWMs because it is essentially equivalent to the volume sent to DWMs.

Full size image

Full network

Similar results hold for the full network, confirming that the formation of U2U pairs is a pervasive phenomenon around DWMs. The total trading volume users sent to DWMs was $3.8 billion, volume received from DWMs was $3.7 billion, while the volume exchanged through U2U pairs reached $30 billion. In Figure S3, we illustrate the number of transactions, trading volume, and lifespan of U2U pairs. In all cases we observe familiar fat-tailed distributions.

We then consider the temporal evolution of transactions. We look at the trading volume over time in Fig. 2c which shows that since 2011 U2U transactions have consistently involved greater monthly volume than the volume sent to all DWMs. This underlines the economic importance of U2U transactions in the Bitcoin ecosystem relative to DWMs.

Behaviour of the U2U network

Henceforth, we are going to analyse users by focusing on the following groups: users who do not form stable U2U pairs; users who form stable U2U pairs, of which there are users who met outside DWMs and users who met inside DWMs (see the nomenclature in Table 2). We start by focusing our attention on identifying stable U2U pairs, i.e., persistent pairs of the U2U network. To this end, we use the evolving activity-driven model31 to identify stable pairs in a statistically-principled way (see Methods). We find 137,667 stable U2U pairs were formed by 106,648 users and generated a trading volume of $1.5 billion. Stable pairs produce five times more transactions per pair than non-stable pairs (two-sided Mann-Whitney-U test34: MNU \(=45.8 \cdot 10^9\), \(p<0.0001\)) corresponding to a 5.34 times larger trading volume (MNU \(= 317 \cdot 10^9\), \(p<0.0001\)), see Figure S4. Stable pairs, despite representing less than 2% of the total number of U2U pairs, generate a disproportionate amount of trading volume.

Figure 3
figure 3

Role of users forming stable U2U pairs. (Main) PDFs of trading volume that users exchange with any DWMs. (Inset) PDFs of time spent by users on any DWMs. These distributions are explored for each of the 40 DWMs under consideration in Figure S5 and S6, respectively. Vertical lines represent median values of the respective distributions.

Full size image

The high activity of users forming stable U2U pairs is not limited to the U2U network—these users are also the most active in trading with DWMs. Users in stable U2U pairs spend a median number of 41 days on DWMs versus a median of only one day for users without stable pairs. The two resulting distributions are significantly different (two-sided Kolmogorov-Smirnov test35: KS \(= 0.673\), \(p<0.0001\)), see the inset of Fig. 3. When we look at the trading volume with DWMs, we find qualitatively similar results. Users in stable U2U pairs transact a median of $400 with DWMs, while other users transact only $56. The two resulting distributions are significantly different (KS \(= 0.438\), \(p<0.0001\)), see Fig. 3. These results hold not only for full network but for every DWM in our data, see Figure S5 and S6.

U2U network evolution

Formation of U2U stable pairs

Having mapped the behaviour of stable pairs, we now consider their temporal evolution. More specifically, we ask: How do stable pairs form? Do DWMs spur their creation? One possible hypothesis is that users meet for the first time while active on a DWM, i.e., after they have both traded with that DWM, see Table 1 and the nomenclature in Table 2. This can be considered as a plausible, and conservative, proxy for users who met inside a DWM (see Methods). A total of 37,129 users have met at least one other user inside a DWM. Their trading volume is about $417 million, and the percentage of users who met inside a DWM is proportional to the trading volume sent to DWMs (Spearman36: \(C=0.805\), \(p<0.0001\)), see Fig. S7, meaning that larger DWMs are more likely to favour the encounter of users than smaller DWMs. Importantly, users who met inside a DWM transact more than those meeting outside a DWM. In particular, users who met inside a DWM trade a median of $2212 between themselves, almost twice the $1379 for users meeting outside the DWM (MNU \(= 1.863 \cdot 10^9\), \(p<0.0001\)). Moreover, users who met inside a DWM tend to transact for significantly longer (median of 61 days) than users meeting outside (median of 50 days) (MNU \(= 2.099 \cdot 10^9\), \(p<0.0001\)).

Table 1 Formation mechanism of stable U2U pairs.
Full size table

Resilience of U2U stable pairs

Thus far, we have shown that users involved in stable trading relationships are also very active on DWMs, where they may meet new trading partners. But are DWMs and the U2U network truly interdependent? In particular, do stable pairs need the DWMs to survive? To answer these questions, we look at market closures, previously investigated to show how active users migrate to other existing DWMs12. Our dataset includes 33 closure events, which we study independently from one another by considering the evolution of the respective 33 marketplace ego networks. We find that non-stable U2U pairs sharply stop interacting immediately after the DWM closure, and therefore their existence is highly sensitive to the presence of the DWM. On the other hand, the trading volume of stable U2U pairs is only marginally affected by the disappearance of the DWM. As a result, while prior to DWM closures non-stable U2U pairs generate an overall trading volume that is 10 times higher than that of stable U2U pairs (since non-stable pairs are far more prevalent), within a few weeks after DWM closures the pattern is reversed: stable U2U pairs generate more trade volume than non-stable U2U pairs. Indeed, trading patterns of stable pairs are not significantly influenced by the sudden DWMs closure, and they very slowly decay over time, see Fig. 4.

Figure 4
figure 4

Resilience of stable U2U pairs after DWMs closure. Trading volume of U2U pairs surrounding active DWMs. (Main) U2U pairs meet who met inside aa DWM. (Inset) U2U pairs meet outside them. Plotted lines indicate the median value while bands represent the 95% confidence interval. Day zero corresponds to the day when the DWM closed. Negative and positive numbers indicate the days prior and after the closure, respectively. Only the 33 DWMs that closed during our time period are considered in the analysis.

Full size image
Figure 5
figure 5

Temporal evolution of stable pairs. (a) Monthly number of new stable U2U pairs created. (b) Monthly trading volume of stable U2U pairs.

Full size image

We have shown that the U2U network is resilient to abrupt external shocks, such as marketplace closures, and does not need the centralised structure of DWMs to survive. What about long-lasting systemic stress? To answer this question, we consider the impact that the COVID-19 pandemic has had on the evolution of stable U2U pairs. Previous studies reported that COVID-19 had a strong impact on DWMs due to delays and damage to the shipping infrastructure caused by border closures37,38. We start by investigating the number of new stable U2U pairs and their trading volume during the COVID-19 period. Users in stable pairs meeting both inside and outside DWMs have been growing over the last two years, since the shutdown of AlphaBay9, the largest DWM at the time. In 2020, a total of 6778 pairs of users in stable pairs met inside a DWM, corresponding to 192% of the 2019 level and to 255% of the 2018 level, see Fig. 5a. Pairs of users in stable pairs meeting inside a DWM traded for a total of $145 million in 2020, which corresponds to 252% of the 2019 level, and to 593% of the 2018 level, see Fig. 5b. We see similar trends for stable U2U pairs meeting outside DWMs. The impact of the COVID-19 pandemic has, however, had different phases, punctuated by the number and level of measures introduced around the world. For users in stable pairs who met both inside and outside DWMs, we find that during the first lockdowns in 2020 trading volume fell with respect to January of the same year, suggesting that they were negatively impacted by COVID-19 restrictions. After that, trading volume sharply increased over the whole of 2020, see Figure S8. The number of stable U2U pairs created each day was, however, steady over time during 2020, even though more U2U pairs were created compared to the same period in 2019, see Figure S9. Overall, stable U2U pairs have shown resilience to the systemic stress caused by COVID-19, suggesting, once again, that these trading relationships are fundamentally independent from the underlying DWMs.

Discussion and conclusion

In this paper, we revealed the prevalence and structure of a large network of direct transactions between users who trade on the same DWM. We showed that some of the links of this user-to-user (U2U) network are ephemeral while other persist in time. We highlighted that a significant fraction of stable U2U pairs formed as their members were trading with the same DWM, suggesting that DWMs may play a role in promoting the formation of stable U2U pairs. We showed that the relationships between users forming stable pairs persist even after the DWM shuts down and are not significantly affected by COVID-19, suggesting overall resilience of stable pairs to external shocks.

Our study has several limitations. In particular, our dataset does not include any attributes related to either users or their Bitcoin transactions, such as, whether the transaction represents an actual purchase or not. Moreover, we do not have information about which users trade with other users on the same DWM. Finally, our coverage of DWMs, albeit extensive, may lack information on other trading forums where users could have met.

Our work has several policy implications. Our findings suggest that DWMs are much more than mere marketplaces39. DWMs are also communication platforms, where users can meet and chat with other users either directly—using Whatsapp, phone, or email—or through specialised forums. These direct interactions may favour the emergence of decentralised trade networks that bypass the intermediary role of the marketplace, similar to what is currently happening on Facebook, Telegram, and Reddit16,17,18,19,20,23, where users post products, negotiate item prices, and then trade directly. We estimate that the trading volume of U2U pairs meeting on DWMs is increasing, reaching a peak in 2020 (during the COVID-19 pandemic). By contrast, trading volume on DWMs was negatively affected by COVID-19, mainly due to shipping delays37,38. The reasons for the differential impact of COVID-19 on U2U trading vs. DWM trading are difficult to pin down. One hypothesis is that U2U pairs managed to find better shipping logistics; another hypothesis is that they were seen as a safer way to trade than DWMs at a time of crisis.

Our results also support recent recommendations of paying attention to individual sellers rather than entire DWMs40. Law enforcement agencies, however, have only recently started targeting individual sellers. The first operation took place in 2018 and successfully led to the arrest of 35 sellers41, while the largest operation to date occurred in 2020 and led to 179 arrests in six different countries42. Our study indicates that a much higher number of highly active DWM users, on the order of tens of thousands, is involved in transactions with other DWM users. Moreover, our analysis paves the way to a deeper understanding of U2U transactions in online marketplaces. Recent results have shown that transaction networks and activity on DWMs and regulated online marketplaces share several robust macroscopic properties43. One might therefore hypothesise that U2U trading is also a prevalent feature on regulated online marketplaces. While data on U2U transactions is far harder to obtain (as these transactions might involve a variety of commercial methods), there is clearly a need to better understand the dynamics and structure of trading relationships beyond what is observable on individual online marketplaces.

Overall, our study provides a first step towards the understanding of how users of DWMs collectively behave outside organised marketplaces. We believe that the results might suggest to researchers, practitioners, and law enforcement agencies that a shift in the attention from the evolution of DWMs to the behaviour of their users might facilitate the design of more appropriate strategies to counteract online trading of illicit goods.

Data and methods

Additional considerations on our data and methods are available in Section S1.

Data preprocessing

The raw dataset consists in transactions between Bitcoin addresses, which is initially preprocessed by Chainalysis Inc. (see Section S2). The resulting dataset consists in transactions between entities, that group together clusters of Bitcoin addresses. We consider only a subset of transactions in this dataset. Namely, we consider transactions made by the 40 entities representing the 40 DWMs under consideration, which directly interact with more than 16 million other entities, who are the users of these DWMs. Users interacting with other users form U2U pairs and we include them in our dataset. We discard single Bitcoin transactions below $0.01 or above $100,000, which are unlikely to show real purchases and minimise false positives. They may be attributed to a residual amount of Bitcoins in an address or transactions between two business partners where no good is actually given in return, respectively. The analysed dataset includes about 31 million transactions among more than 16 million users. Finally, we note that the same user can interact in multiple DWMs12,13. By definition, users that interact among themselves form U2U transactions. If the pair of users interact with multiple DWMs these U2U transactions are included in all related DWMs and counted multiple times. Therefore, the simple sum of all U2U transactions of each DWM is more than the sum of all unique U2U transactions. We count a total of 11 million transactions around all DWMs, that goes down to 9.9 million when multiple counting is avoided. Similarly, the simple sum of the single trading volumes surrounding all DWMs amounts to $33 billion, while the overall trading volume in all unique U2U pairs is $30 billion. Among the 40 large DWMs under consideration, 17 participate in at least one transaction in either 2020 or 2021, while the remaining 23 closed before 2020. Notably, our dataset includes Silk Road (the first modern DWM)1, Alphabay (once the leading DWM)44, and Hydra (currently the largest DWM in Russia)12. Other general statistics about our dataset can be found in the Section S3.

Figure 6
figure 6

U2U network. The U2U network is formed by the entire set of interacting users (black and gray arrows with their respective users). Using the evolving activity-driven model31, U2U pairs are divided in either stable (black arrows and respective users) or non-stable (gray arrows and respective users).

Full size image

Detection of the U2U network

The detection of stable U2U pairs in the full network is done by using an evolving activity-driven model31, which introduced a statistically-principled methodology to detect the network backbone against what is expected from a proper null model. If a U2U pair occurs significantly more than what expected from the null model, it is labeled as stable, otherwise it is labelled as non-stable, see Fig. 6. The evolving activity-driven model is an appropriate methodology for large temporal networks32 and it is implemented in the Python 3 pip library TemporalBackbone45, where default parameter values have been used. As input parameter, we considered the full network, transactions from/to DWMs and U2U transactions between users (see Section S4).

Users who met inside a DWM

We determine whether U2U pairs meet while active on a DWM by looking at the time occurrence of their first U2U transaction. This transaction can occur at three different moments in time: (i) At \(t=t_1\), before both users interact with the same DWM (occurring at \(t=t_2>t_1\) and \(t=t_3>t_1\), respectively), as shown on the left hand side of Table 1. (ii) At \(t=t_2\), when only one user has interacted with a specific DWM and the other user will do so at a later time, as shown in the middle column of Table 1. (iii) At \(t=t_3\), when both users have interacted with the same DWM, as in the right column of Table 1. We classify these three chains of events in two groups. One group includes all pairs that meet outside any DWMs, which includes case (i) and case (ii), and the other group includes users that meet inside a DWM, described by case (iii). This last case constitutes a conservative proxy for users that meet inside a DWM. The proxy admits the possibility of false positives, since it counts users who met inside the same DWM without having interacted on it, as well as false negatives, since it does not take into account users who met inside a DWM without having ever interacted on it. The latter is arguably more significant, since it is possible that only one of the two users (the seller) has actually engaged in transactions with the DWM, while the other user, after seeing the seller’s profile on a DWM, has established a direct contact, through Whatsapp, email, or phone.

Nomenclature of all groups considered

We provide the definition of all considered groups in Table 2.

Table 2 Nomenclature.
Full size table